PT-2024-3184 · Freerdp+9 · Freerdp+9

Lowakallabeth · Published 2024-04-23 · Updated 2026-03-10 · CVE-2024-32659

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.5.1

Description The issue is related to an out-of-bounds read in the FreeRDP client, specifically in the freerdp image copy function. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when ((nWidth == 0) and (nHeight == 0)).

Recommendations For versions prior to 3.5.1, update to version 3.5.1, which contains a patch for the issue. As a temporary workaround, consider restricting the use of the freerdp image copy function until the patch is applied. Avoid using the condition ((nWidth == 0) and (nHeight == 0)) in the affected clients until the issue is resolved.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2025-4980

BDU:2024-03402

CVE-2024-32659

DLA-4053-1

GHSA-8JGR-7R33-X87W

INFSA-2024_9092

OESA-2024-1515

OPENSUSE-SU-2024:13994-1

OPENSUSE-SU-2024_1856-1

OPENSUSE-SU-2024_2631-1

OPENSUSE-SU-2026:10123-1

OPENSUSE-SU-2026:20339-1

RHSA-2024:9092

RHSA-2024_9092

RLSA-2024:9092

SUSE-SU-2024:1835-1

SUSE-SU-2024:1856-1

SUSE-SU-2024:2631-1

USN-6752-1

USN-6759-1

USN-7371-1

Affected Products

Alt Linux

Astra Linux

Debian

Freerdp

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 153

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32659.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/6430945ce003a5e24d454d8566f54aae1b6b617b · Patch
• https://ubuntu.com/security/CVE-2024-32659 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-32659 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6752-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32459 · Security Note
• https://osv.dev/vulnerability/USN-6752-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:9092 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7371-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9092.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32659 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-32659 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32460 · Security Note